Security model for industrial devices

ABSTRACT

Systems and/or methods are described relating to a security model that provides interoperability with foreign security domains while remaining scalable to small embedded devices. A security token service is provided, which is configured to issue, renew, and/or validate security tokens in response to a token request. A communication protocol, corresponding message structures, and the security tokens are defined in accordance with protocol buffer definitions.

PRIORITY CLAIM

This patent application is a continuation of U.S. patent applicationSer. No. 13/934,701, filed Jul. 3, 2013 and entitled, “SECURITY MODELFOR INDUSTRIAL DEVICES,” which is a continuation of U.S. patentapplication Ser. No. 12/905,676, filed Oct. 15, 2010 and entitled“SECURITY MODEL FOR INDUSTRIAL DEVICES.” The entireties of each areincorporated herein by reference.

TECHNICAL FIELD

The subject disclosure relates to a security model for an industrialautomation environment, and more particularly, to an interoperablesecurity model suitable for embedded industrial automation devices.

BACKGROUND

Security is an important aspect in industrial automation environments.Access to machines and devices within a factory or other automationenvironment should be controlled to avoid unauthorized or inappropriateinteractions with the machines and devices by persons lacking propertraining, authority, or credentials. In addition, operations on machinesand devices should be strictly controlled to provide various levels ofpermissions to different persons having disparate roles with theindustrial automation environment. To implement the aforementionedsecurity features, an operator, when accessing a machine or device inthe industrial automation environment, can supply credentials specifyingan identity of the operator. The machine or device, once the credentialsare validated, can grant rights to the operator and enable access tofeatures based upon permissions associated with the operator.

Commonly, industrial automation environments employ proprietary securitysolutions within the environment. The proprietary security solutions maynot interoperate or trust foreign security domains. Withoutinteroperation, the industrial automation environment resides on asecurity island.

In other areas, such as web services, a set of standard security-relatedspecifications have emerged. For web services, in particular, theOrganization for the Advancement of Structured Information Standards(OASIS) has promulgated a variety of specifications, such asWS-Security, WS-Trust, SAML, etc., that relate to implementing securityfeatures (e.g., authentication, trust building) between loosely coupledsystems. More particularly, WS-Security is a specification that providesa basic framework for message level security in web services. WS-Trustextends WS-Security and provides a framework to establish or brokertrust among disparate security domains. SAML (Security Assertion MarkupLanguage) is an XML-based standard for representing security claims orassertions. The aforementioned standards are intended for use byenterprise level systems (e.g., large web servers, powerful generalpurpose computers, etc.) as they rely upon Internet-based technologies,such as HTTP, SOAP, XML, etc. Such Internet-based technologies, however,require tremendous resources, and, as such, do not scale to smallembedded systems having limited processing capabilities, limited memory,etc.

SUMMARY

The following presents a simplified summary of the innovation in orderto provide a basic understanding of some aspects described herein. Thissummary is not an extensive overview of the disclosed subject matter. Itis intended to neither identify key or critical elements of thedisclosed subject matter nor delineate the scope of the subjectinnovation. Its sole purpose is to present some concepts of thedisclosed subject matter in a simplified form as a prelude to the moredetailed description that is presented later.

According to various aspects, a security model is described thatprovides interoperability with foreign security domains while remainingscalable to small embedded devices. A security token service isprovided, which is configured to issue, renew, and/or validate securitytokens in response to a token request. A communication protocol,corresponding message structures, and the security tokens are defined inaccordance with protocol buffer definitions.

According to a first aspect, the security token service is integratedwithin an embedded device. The embedded device can be an industrialautomation device within an industrial automation environment. Thesecurity token service, within the device, can authenticate andauthorize a user interfacing directly with the embedded device. Theembedded device includes account information stored thereon tofacilitate authentication and authorization by the security tokenservice.

According to a second aspect, the security token service is integratedwithin a network appliance. The security token service can obtain tokenrequests transmitted by devices via a network. The network appliance caninclude account information stored thereon to enable the security tokenservice to authenticate and authorize users based upon the tokenrequests. The security token service can issue security tokens andtransmit the tokens, via the network, to various devices.

According to a third aspect, the security token service can beassociated with a gateway device on a network. The gateway devicecommunicates with an external entity to authenticate and authorizeusers. The communication can be based upon the WS-Trust specification.The gateway device can translate security tokens and/or token requestsbetween an XML representation specified by WS-Trust and the protocolbuffer definitions.

The following description and the annexed drawings set forth in detailcertain illustrative aspects of the disclosed subject matter. Theseaspects are indicative, however, of but a few of the various ways inwhich the principles of the innovation may be employed and the disclosedsubject matter is intended to include all such aspects and theirequivalents. Other advantages and distinctive features of the disclosedsubject matter will become apparent from the following detaileddescription of the innovation when considered in conjunction with thedrawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a block diagram of an example system that employs asecurity token service to issue, renew, and validate security tokens inaccordance with various aspects.

FIG. 2 illustrates a block diagram of an example system in which asecurity token service is employed to identify and authenticate a userin accordance with various aspects.

FIG. 3 illustrates a flow diagram of an example method forauthenticating users and issuing security tokens in accordance withvarious aspects.

FIG. 4 illustrates a block diagram of an embedded device that utilizes asecurity token service to identify and authenticate a user of the deviceaccording to one or more aspects.

FIG. 5 illustrates a block diagram of an example system that includes anetwork appliance providing issuance, renewal, and validation ofsecurity tokens in accordance with various aspects.

FIG. 6 illustrates a block diagram of an example system that includes agateway to external identity providers according to one or more aspects.

FIG. 7 illustrates a block diagram of an example system that includes agateway to a security server that interacts with external identityproviders in accordance with various aspects.

FIG. 8 illustrates a flow diagram of an example method for bridging withforeign security domains in accordance with various aspects.

FIG. 9 illustrates a schematic block diagram of an exemplary computingenvironment, according to an aspect

FIG. 10 illustrates a block diagram of a computer operable to executethe disclosed aspects.

DETAILED DESCRIPTION

Various aspects are now described with reference to the drawings,wherein like reference numerals are used to refer to like elementsthroughout. In the following description, for purposes of explanation,numerous specific details are set forth in order to provide a thoroughunderstanding of one or more aspects. It will be evident, however, thatsuch aspect(s) can be practiced without these specific details. In otherinstances, well-known structures and devices are shown in block diagramform in order to facilitate describing these aspects.

Referring initially to FIG. 1, illustrated is an exemplary system 100,according to an aspect. System 100 is configured to utilize securitytokens to facilitate identification, authentication, and authorizationof users. In an aspect, a security token includes a set of claims orassertions that specify a variety of information. For instance, asecurity token can include a name, a role, an authorization code, anindication that the name is authenticated, a time of authentication, alist of permitted actions, cryptographic key information, or the like.It will be appreciated from the description below, however, thatsecurity tokens can include additional information to that delineatedabove.

System 100 is configured to provide delegation of authentication,authorization, etc, of users and can include a requester 110 configuredto obtain a security token from a security apparatus 120. Requester 110can be an entity configured to interact with a user (not shown).Requester 110 can employ security apparatus 120 to authenticate theuser. In accordance with one example, wherein system 100 is deployedwithin an industrial automation environment, requester 100 can be aindustrial automation device or tool such as, but not limited to, acontroller (e.g., programmable automation controller (PAC), programmablelogic controller (PLC), and so forth), a human machine interface (HMI),an industrial machine, or the like.

Requester 110 obtains credential information from a user desiring toaccess some functionality provided by requester 110. The credentialinformation can be a username/password pair, a security token, aKerberos ticket, etc. Requester 110 issues a token request 130, to thesecurity apparatus 120, that includes at least a portion of thecredential information. In response, the security apparatus 120 canprovide a security token 140 to the requester 110. Security token 140can indicate, at least, whether the credential information is authentic.According to additional aspects, the security token 140 can includeattributes of the user, permitted actions the user is authorized toperform, a role of the user, an identity of the user, and so on.

The requester 110 and the security apparatus 120 can utilize protocolbuffers to implement and convey the token request 130 and the securitytoken 140. Protocol buffers are a language-neutral, platform-neutral,extensible mechanism to serialize structured data for use incommunications protocols. One or more protocol messages can be definedthat specify how information is to be structured. Each protocol messagecan include a set of name-value pairs respectively having a name and avalue type. Value types can include numbers (e.g., integers or floatingpoint values), Booleans, strings, raw bytes, and the like. In addition,value types can also include other protocol messages. Accordingly,protocol buffers enable information to be structured hierarchically.

Once protocol messages are defined, the definitions can be run through aprotocol buffer compiler to automatically generate data accessmechanisms as well as serialization/de-serialization mechanisms. Theserialization/de-serialization mechanisms are configured to convert aprotocol message object (e.g., an object instance of the protocolmessage populated with actual data) into a protocol buffer (e.g., rawbytes) and convert the protocol buffer into the protocol message object.The data access mechanisms facilitate retrieval and setting of valuesassociated with a particular name-value pair, protocol message objects,in accordance with the structure of the protocol messages.

With protocol buffers, a protocol message defining a structure for tokenrequest 130 can be created. The protocol message corresponding to tokenrequest 130 can be compiled to generate data access andserialization/de-serialization mechanisms employable by requester 110and security apparatus 120. Similarly, a protocol message, defining astructure for security token 140, can be provided and compiled togenerate corresponding data access and serialization/de-serializationmechanisms.

In addition to structures for information (e.g., protocol messages),protocols buffers enable definitions of services. For example, a servicecan be established that utilized defined protocol messages, such a tokenrequest protocol message and a security token protocol message. Theservice definition can be compiled to generate an abstract interface,which can be implemented as part of a remote procedure call or othercommunication protocol to exchange information between multipleentities.

With a service defined and/or protocol messages for token request 130and security token 140, requester 110 can instantiate a token requestprotocol message object and populate the object with information such asthe credential information. The token request protocol message objectcan be serialized into a series of raw bytes to generate token request130. Requester 110 can convey token request 130 to the securityapparatus 120 via a remote procedure call or other communicationprotocol.

Security apparatus 120 can receive token request 130 as a series of rawbytes. Security apparatus 120, in an aspect, can include a protocolbuffer component 122 configured to manage protocol messages, such astoken request 130 and security token 140. The protocol buffer component122 instantiates a protocol message object based upon the correspondingprotocol message of token request 130. Protocol buffer component 122de-serializes token request 130, obtained from requester 110, andpopulates the instantiated protocol message object with thede-serialized token request. Information contained within thede-serialized token request 130 (e.g., credential information) can beprovided to a security token service (STS) 124.

STS 124 is configured to issue, validate, and/or renew security tokens.The security tokens include one or more claims or assertions determinedby STS 124 based upon credential information. According to an example,STS 124 obtains credential information from protocol buffer component122. The credential information can be extracted from token request 130.STS 124 can authenticate the credential information and issue acorresponding security token that includes at least a claim indicatingthat the credential information is authenticated.

Authentication can occur in accordance with a variety of schemes. In oneexample, the credential information can include a username and password.STS 124 can check the username and password against a data store (notshown) that retains user information. The data store can be associatedwith security apparatus 120 or, as described in greater detail below,associated with a remote entity such as an external identity provider.In another example, the credential information can include a securitytoken previously issued from STS 124. STS 124 can issue a new token orrenew the token included in the credential information. In yet anotherexample, the credential information can include a security token fromanother entity. STS 124 can issue a security token based upon the claimsin the provided token when the token is issued from a trusted entity.

STS 124 can generate issued tokens in accordance with a structuredefined by a protocol message for security tokens. Issued tokens, suchas security token 140, can be serialized by protocol buffer component122 and conveyed to requester 110 in response to token request 130. Therequester 110 can de-serialize security token 140 and render accessdecisions based at least in part on claims included in the securitytoken 140. For instance, requester 110 can permit a user to performcertain operations authorized by claims in the security token 140.

While shown as separate components in FIG. 1, it is to be appreciatedthat protocol buffer component 122 can be included in or combined withSTS 124, such that STS directly communicates with requester 110 inaccordance with protocol buffer mechanisms. In addition, it is to beappreciated that security apparatus 120 can be STS 124 itself. Further,additional security, such as encryption, digital signatures, or thelike, can be layered upon the message exchange between requester 110 andsecurity apparatus 120.

FIG. 2 illustrates a system 200 in which a security token service isemployed to identify and authenticate a user in accordance with variousaspects. As illustrated in FIG. 2, system 200 can include a requester210 configured to communicate with a security apparatus 220 toauthenticate and/or authorize a user accessing requester 210. In anaspect, security apparatus 220 can be configured as a security tokenservice as described above. As a security token service, securityapparatus 220 is configured to issue, renew, and/or validate securitytokens. The security tokens can be utilized by requester 210 to renderand enforce access decisions with respect to users.

In an aspect, requester 210 can include a user interface 212 configuredto obtain input from a user and convey output to the user. The userinterface 212 can include a variety of hardware and/or softwarecomponents. For example, the user interface 212 can include a keyboard,a mouse, a touch screen or display screen displaying a graphical userinterface (GUI) generated by software applications, a microphone,speakers, a video camera, etc.

Requester 210 can further include a protocol buffer 214 configured tostructure information in accordance with protocol messages, such astoken request 230 and security token 240, serialize protocol messagesinto series of bytes, de-serialize byte streams into structuredinformation, and extract data from the structured information. Protocolbuffer 214 facilitates communication between requester 210 and securityapparatus 220 through remote procedure calls or other communicationprotocols.

In addition, requester 210 can include a cryptography component 216configured to provide cryptographic functions, such as digitalsignatures, encryption, etc. In an aspect, cryptography component 216can digitally sign protocol messages generated by protocol buffer 214prior to sending the protocol messages to security apparatus 220. Inaddition, cryptography component 216 can authenticate and integritycheck signed protocol messages received from security apparatus 220.

According to another aspect, requester 210 can include an access controlcomponent 218 configured to render access decisions based, at least inpart, on security tokens obtained from the security apparatus 218. Forinstance, access control component 218 can determine whether or not togrant access to a user based upon the security tokens. In addition,access control component 218 can restrict access to particular functionsor features based upon the security tokens. In an example, accesscontrol component 218 can analyze a security token and ascertain that auser is authenticated and can be granted access. The access controlcomponent 218 can further evaluate claims included in the security tokento determine a role associated with the user and/or identify authorizedactions the user permitted to initiate. Access control component 218 canconfigure user interface 212 to facilitate enforcement of accessrestrictions based upon the role of the user or the authorized actions.

Security apparatus 220 can include a cryptography component 222configured to provide cryptographic functions, such as digitalsignatures, encryption, etc. In an aspect, cryptography component 222can digitally sign protocol messages prior to sending to such messagesto requester 210. In addition, cryptography component 220 canauthenticate and integrity check signed protocol messages received fromrequester 210. Security apparatus 220 can also include a protocol buffer224 configured to structure information in accordance with protocolmessages, such as token request 230 and security token 240, serializeprotocol messages into series of bytes, de-serialize byte streams intostructured information, and extract data from the structuredinformation. Protocol buffer 224, similar to protocol buffer 214 ofrequester 210, facilitates communication between requester 210 andsecurity apparatus 220 through remote procedure calls or othercommunication protocols.

In accordance with another aspect, wherein security apparatus 220operates as an identity provider, an authentication component 226 isprovided. Authentication component 226 is configured to verifycredential information, which can be provided to security apparatus 220by requester 210 as part of a token request. Authentication component226 can query a data store 227 that retains account information.Authentication component 226 can validate credential information whensuch information is included and/or matches information in data store227.

A result of authentication by the authentication component 226, thetoken request processed by protocol buffer 224, and credentialinformation contained in the token request can be provided to a tokengeneration component 228. The token generation component 228 isconfigured to issue security tokens, based at least in part, on theresult of authentication, the credential information and/or the tokenrequest. In one aspect, token generation component 228 can issueprotocol buffer security tokens that conform to a structure defined by aprotocol message employable by protocol buffer mechanisms. However, itis to be appreciated that token generation component 228 can issue othertokens such as, for example, a SAML token.

Referring to FIG. 3, in connection with FIG. 2, a methodology 300related to authenticating a user and issuing a security token isdescribed. While, for purposes of simplicity of explanation, theprocesses or methodologies are shown and described as a series or numberof acts, it is to be understood and appreciated that the subjectprocesses are not limited by the order of acts, as some acts may, inaccordance with the subject processes, occur in different orders and/orconcurrently with other acts from that shown and described herein. Forexample, those skilled in the art will understand and appreciate that amethodology could alternatively be represented as a series ofinterrelated states or events, such as in a state diagram. Moreover, notall illustrated acts may be required to implement a methodology inaccordance with the subject processes described herein.

At 302, a user, desiring to access requester 210, can input credentialinformation via user interface 212. At 304, requester 210 can employ theprotocol buffer 214 to generate token request 230 that includes thecredential information. In an aspect, the token request 230 caninformation structured in accordance with a protocol message defined inaccordance with the protocol buffer technology. At 306, the protocolbuffer 214 serializes token request 230 from a structured object to aseries of raw bytes.

At 308, cryptography component 216 can digitally sign token request 230to generate signed token request 232. In one example, cryptographycomponent 216 can utilize public-key cryptography to sign token request232. For instance, cryptography component 216 can hash token request 230to generate a message digest. The message digest can be encrypted with aprivate key to produce a signature, which is attached to the tokenrequest 230 to generate the signed token request 232. At a receiver end,the signed token request 232 is separated (e.g., the signature isextracted from token request 230). The signature is decrypted with apublic key paired to the private key. In addition, the token request,with signature removed, is hashed. The signed token request 232 isauthenticated and checked when the hash and the decrypted signaturematch. Public key cryptography is described herein as an exemplaryalgorithm and it is appreciated that other cryptographic algorithms canbe employed and, further, it is intended that the claims appended heretoare not limited to public-key cryptography.

At 310, the signed token request 232 is sent to the security apparatus220. As described in more detail below, the signed token request 232 canbe conveyed to the security apparatus 220 via a variety of meansdepending on the specific implementation of security apparatus 220 andrequester 210. For example, request 210 can send the signed tokenrequest 232 via a remote procedure call, a pipe between processes, anetwork connection, a hardware bus, a method call, etc.

At 312, cryptography component 222 of security apparatus 220 can verifythe signed token request 232 and recover a token request 234. Asdescribed above, cryptography component 222 can, in one example, employa public key associated with requester 210 and paired with a private keyof requester 210. At 314, the token request 234 is de-serialized byprotocol buffer 224 to convert the series of raw bytes into a structuredobject that includes the credential information. At 316, securityapparatus 220 can employ the protocol buffer 224 to extract thecredential information from the structure object representation of tokenrequest 234. At 318, security apparatus 220 authenticates the credentialinformation. For example, authentication component 226 can query thedata store 227 with the credential information to determine if thecredential information corresponds to a valid user account. A result ofauthentication can be provided to the token generation component 228where, at 320, a security token 244 is generated. At 322, protocolbuffer 224 can serialize security token 244 into a series of bytes. At324, security apparatus 220 can employ the cryptography component 222 todigitally sign security token 244 to generate a signed security token242. At 326, the signed security token 244 is sent to the requester 210.At 328, cryptography component 216 of requester 210 verifies the digitalsignature of signed security token 242 and recovers security token 240.At 330, the protocol buffer 214 de-serializes security token 240 and, at332, access control component 332 can render access control decisionsbased at least in part on security token 240.

Referring to FIGS. 4-7, illustrated are example systems depictingvarious implementations of the security model described above within anindustrial automation environment according to one or more aspects. Inthese example systems, an industrial automation device operates as arequester as described above. As will become evident with these examplesystems, the security model described above can operate at variouslevels within the industrial automation environment, from a small-scaleintegrated environment of a single device to large-scale network wideenvironments. Accordingly, the security model can provide securitywithin a home domain and, also, can be extended to provideinteroperability with foreign domains.

In FIGS. 4-7, and the associated descriptions, a device can be anysuitable industrial automation device (e.g., a machine (press, stamp,conveyor, robot, etc.), a controller, an HMI, and so forth) or any othersuitable computing device (e.g., a personal computer, a laptop, a mobiledevice, etc.). In addition, a security apparatus described below inconnection with FIGS. 4-7 can be substantially similar to and/or performsimilar functionality as security apparatus 110 and 210. Moreover,interactions between devices and security apparatus can occur in amanner consistent with system 100, system 200, and method 300 describedsupra with respect to FIGS. 1-3.

FIG. 4 depicts an example system 400 that includes an embedded device402 operating as a requester. In an aspect, device 402 can be anembedded system coupled to an industrial automation device such as, butnot limited to, a computer, an HMI, a press, a stamping machine, aconveyor, a robot, or any other industrial machine or apparatusdeployable within a factory or processing facility.

Device 402 can include a processing unit 404, a system memory 406, auser interface 418, a machine interface 420, and a network adapter 422interconnected via a bus 422. System memory 406 can include anon-volatile memory, such as ROM 408, and a volatile memory, such as RAM410. System memory 406 can also include a persistent storage 412, whichcan include substantially any tangible, non-volatile computer-readablestorage media. For instance persistent storage 412 can include mediasuch as, but not limited to, flash memory, a hard disk, a solid statedisk drive, a magnetic-based media (e.g., tape, etc.), an optical-basedmedia (e.g., CD-ROM, DVD, Blu-Ray, etc.), or the like.

System memory 406 can retain software and/or firmware programs such asapplications 414 and operating system 416. In an aspect, applications414 and/or operating system 416 can be transferred from ROM 408 and/orpersistent storage 412 into RAM 410. Processing unit 404 can execute theapplications 414 and operating system 416 from RAM 410 to implementfunctionality of device 402 and provide interaction with users. Forinstance, applications 414 and/or operating system 416 can generate agraphical user interface, which is displayed to users via user interface418.

Device 402 can interface with various mechanical and electrical hardwarecomponents of the associated industrial automation device via machineinterface 420. Further, device 402 can communicate via a communicationnetwork (e.g., a LAN, a DeviceNet, a control network, a WAN, theInternet, etc.) via network adapter 422.

In an aspect, device 402 can utilize an integrated security component426 to authenticate users. Security component 426 can be integrated ontoa circuit board of device 402, wherein the circuit board includes bus424 and supports the various hardware components (e.g., processing unit404, system memory 406, machine interface 420, network adapter 422, anduser interface 418). According to one aspect, security component 426 canbe coupled to bus 424 to communicate with processing unit 404, userinterface 418, system memory 406, and/or any applications 414 andoperating system 416 executed therefrom. Security component 426 caninclude an embedded sub-processor (not shown) and memory unit (notshown) to implement security functionality within a securedsub-environment of device 402. In another aspect, security component 426can implemented via an application 414 and/or operating system 416.

Security component 426 can be substantially similar to and performsimilar functionality as security apparatus 110 and 210 described abovewith reference to FIGS. 1 and 2. For example, security component 426 canissues security tokens in response to token requests that includecredential information, as described above.

In an example, a user can supply credential information via userinterface 418. For instance, the user can enter a username and passwordvia a login interface of user interface 418, or the user can supplycredential information via other mechanisms (e.g., smart card, USBdevice, an electronic key fob, etc.). The applications 414 and/oroperating system 416 can include access control sub-routines thatincorporate the credential information into an information structurepre-defined based upon a protocol message definition for a tokenrequest. The token request, including the credential information, can beserialized and sent, by the applications and/or operating 416 via aninter-process communication to an application implementing securitycomponent 426 or via bus 424 to security component 426 integrated ontothe circuit board of device 402. The security component 426de-serializes the token request, checks the credential information, andgenerates a security token. The security token can include a set ofassertions as described above, and can be organized into a structurepre-defined by another protocol message definition. The security tokencan be serialized and returned to the requesting entity (e.g.,applications 414 and/or operating system 416). The security token isde-serialized and evaluated to render access decisions related to theuser. If access is granted, the security token can include additionalassertions that define a level of access to grant to the user.Applications 414 and/or operating system 416 provide interactions withthe user in accordance with the defined level of access.

FIG. 5 depicts an example system 500 that includes a network applianceproviding issuance, renewal, and validation of security tokens inaccordance with various aspects. System 500 can include a securityapparatus 502 accessible, via network 506, by device (requester) 504. Inan example, security apparatus 502 can be similar to security apparatus110 and/or 210 described supra. In addition, device 504 can be similarto requester 110, requester 210, and/or device 402 described herein.

In an aspect, device 504 can obtain credential information that requiresauthentication. Device 504, using protocol buffer mechanisms, cantransmit the credential information as a token request to securityapparatus 502, via network 504. Security apparatus 502 receives thetoken request, validates the included credential information, and issuesa security token based thereupon. Security apparatus 502 can return thesecurity token to device 504, using protocol buffer mechanisms. Device504 can analyze the security and determine a level of access to provideto a user associated with the credential information. As shown in FIG.5, other devices, such as devices 508, 510, and 512, are coupled tonetwork 506. In an aspect, devices 508, 510, and 512 are configured tooperate as requesters, as described above. The devices 508, 510, and 512can submit token requests to security apparatus 502 and obtain securitytokens therefrom.

Turning to FIG. 6, illustrated is an example system 600 in accordancewith various aspects. In an aspect, system 600 can include a device 602configured to request a security token from a security apparatus 606 viaa network 604. In the request, device 602 can include credentialinformation provided by a user. In an aspect of system 600, thecredential information can be associated with a domain for whichsecurity apparatus 606 does not retain associated account information.Instead of issuing a security token directly to device 602, securityapparatus 606 can operate as a delegate or proxy and obtain a securitytoken from an external identity provider 612. External identity provider612 can be a directory server, such as an Active Directory server, anLDAP server, etc., a UNIX domain server, a trusted third partyauthentication service, or the like.

According to an aspect, security apparatus 606 includes a gatewaycomponent 608 configured to request and obtain a security token from theexternal identity provider 612. Gateway component 608 can request atoken from the external identity provider 612 in accordance with theWS-Trust specification for web services. Accordingly, gateway component608 can obtain a SAML security token from the external identityprovider. Security apparatus 606 includes a converter 610 thattranslates the SAML security token into a protocol buffer securitytoken. The security apparatus 606 can return the protocol buffersecurity token to device 602 via network 604.

Referring now to FIG. 7, illustrated is an example system 700 inaccordance with various aspects. In an aspect, system 700 can include adevice 702 configured to request a security token via a network 704.Device 702 sends a token request, which includes credential information,to a gateway apparatus 706. The gateway apparatus employs the credentialinformation as part of WS-Trust exchange, performed by a WS-Trustcomponent 710, with a security server 712. The security server 712includes a security token service 714 and a directory server 716. Thesecurity token service 714 can issue, renew, or validate securitytokens.

According to an example, security token service 714 and/or securityserver 712 does not retain account information corresponding to thecredential information. Accordingly, security token service 714delegates authentications to directory server 716, which accesses anexternal identity provider 718 to validate the credential information.Once validated, the security token service 714 can issue a securitytoken and return the token to the WS-Trust component 710 of gatewayapparatus 706.

In another aspect, the security token from the security token service714 can be a SAML token. Accordingly, gateway apparatus includes aconverter 708 configured to translate the SAML security token into aprotocol buffer security token. The gateway apparatus 706 can return theprotocol buffer security token to device 702 via network 704.

Referring to FIG. 8, a method 800 for bridging with foreign securitydomains is illustrated. At 802, a token request is obtained from adevice. At 804, the token request is employed to send a second tokenrequest to an external identity provider. In an aspect, the first tokenrequest can in a protocol buffer format utilized by the device and thesecond token request can be in an XML format specified in the WS-Truststandard utilized by web services and enterprise systems. At 806, asecurity token is received from the external identity provider. In anexample, the security token can be a SAML security token. However, it isto be appreciated that the security token can be formatted as a Kerberosticket, an X.509 token, or the like. At 808, the received security tokenis converted to a format recognizable by the device. According to anaspect, the recognizable format can be a protocol buffer encoding of asecurity token. At 810, the protocol buffer encoding of the securitytoken is conveyed to the device.

In order to provide additional context for implementing various aspectsof the claimed subject matter, FIGS. 9 and 10 and the followingdiscussion is intended to provide a brief, general description of asuitable computing environment in which the various aspects of thesubject innovation may be implemented. For example, the host applicationas well as the extensible framework can be implemented in such suitablecomputing environment. While the description above is in the generalcontext of computer-executable instructions of a computer program thatruns on a local computer and/or remote computer, those skilled in theart will recognize that the subject innovation also may be implementedin combination with other program modules. Generally, program modulesinclude routines, programs, components, data structures, etc., thatperform particular tasks and/or implement particular abstract datatypes.

Generally, program modules include routines, programs, components, datastructures, etc., that perform particular tasks or implement particularabstract data types. Moreover, those skilled in the art will appreciatethat the claimed subject matter can be practiced with other computersystem configurations, including single-processor or multiprocessorcomputer systems, minicomputers, mainframe computers, as well aspersonal computers, hand-held computing devices, microprocessor-based orprogrammable consumer electronics, and the like, each of which can beoperatively coupled to one or more associated devices.

The illustrated aspects may also be practiced in distributed computingenvironments where certain tasks are performed by remote processingdevices that are linked through a communications network. In adistributed computing environment, program modules can be located inboth local and remote memory storage devices.

Computing devices typically include a variety of media, which caninclude computer-readable storage media and/or communications media,which two terms are used herein differently from one another as follows.Computer-readable storage media can be any available storage media thatcan be accessed by the computer and includes both volatile andnonvolatile media, removable and non-removable media. By way of example,and not limitation, computer-readable storage media can be implementedin connection with any method or technology for storage of informationsuch as computer-readable instructions, program modules, structureddata, or unstructured data. Computer-readable storage media can include,but are not limited to, RAM, ROM, EEPROM, flash memory or other memorytechnology, CD-ROM, digital versatile disk (DVD) or other optical diskstorage, magnetic cassettes, magnetic tape, magnetic disk storage orother magnetic storage devices, or other tangible and/or non-transitorymedia which can be used to store desired information. Computer-readablestorage media can be accessed by one or more local or remote computingdevices, e.g., via access requests, queries or other data retrievalprotocols, for a variety of operations with respect to the informationstored by the medium.

Communications media typically embody computer-readable instructions,data structures, program modules or other structured or unstructureddata in a data signal such as a modulated data signal, e.g., a carrierwave or other transport mechanism, and includes any information deliveryor transport media. The term “modulated data signal” or signals refersto a signal that has one or more of its characteristics set or changedin such a manner as to encode information in one or more signals. By wayof example, and not limitation, communication media include wired media,such as a wired network or direct-wired connection, and wireless mediasuch as acoustic, RF, infrared and other wireless media.

Referring now to FIG. 9, there is illustrated a schematic block diagramof an exemplary computer compilation system operable to execute thedisclosed architecture. The system 900 includes one or more client(s)902. The client(s) 902 can be hardware and/or software (e.g., threads,processes, computing devices). In one example, the client(s) 902 canhouse cookie(s) and/or associated contextual information by employingone or more features described herein.

The system 900 also includes one or more server(s) 904. The server(s)904 can also be hardware and/or software (e.g., threads, processes,computing devices). In one example, the servers 904 can house threads toperform transformations by employing one or more features describedherein. One possible communication between a client 902 and a server 904can be in the form of a data packet adapted to be transmitted betweentwo or more computer processes. The data packet may include a cookieand/or associated contextual information, for example. The system 900includes a communication framework 906 (e.g., a global communicationnetwork such as the Internet) that can be employed to facilitatecommunications between the client(s) 902 and the server(s) 904.

Communications can be facilitated via a wired (including optical fiber)and/or wireless technology. The client(s) 902 are operatively connectedto one or more client data store(s) 908 that can be employed to storeinformation local to the client(s) 902 (e.g., cookie(s) and/orassociated contextual information). Similarly, the server(s) 904 areoperatively connected to one or more server data store(s) 910 that canbe employed to store information local to the servers 904.

With reference to FIG. 10, an exemplary environment 1000 forimplementing various aspects described herein includes a computer 1002,the computer 1002 including a processing unit 1004, a system memory 1006and a system bus 1008. The system bus 1008 couples to system componentsincluding, but not limited to, the system memory 1006 to the processingunit 1004. The processing unit 1004 can be any of various commerciallyavailable processors. Dual microprocessors and other multi-processorarchitectures may also be employed as the processing unit 1004.

The system bus 1008 can be any of several types of bus structure thatmay further interconnect to a memory bus (with or without a memorycontroller), a peripheral bus, and a local bus using any of a variety ofcommercially available bus architectures. The system memory 1006includes read-only memory (ROM) 1010 and random access memory (RAM)1012. A basic input/output system (BIOS) is stored in a non-volatilememory 1010 such as ROM, EPROM, EEPROM, which BIOS contains the basicroutines that help to transfer information between elements within thecomputer 1002, such as during start-up. The RAM 1012 can also include ahigh-speed RAM such as static RAM for caching data.

The computer 1002 further includes an internal hard disk drive (HDD)1014 (e.g., EIDE, SATA), which internal hard disk drive 1014 may also beconfigured for external use in a suitable chassis (not shown), amagnetic floppy disk drive (FDD) 1016, (e.g., to read from or write to aremovable diskette 1018) and an optical disk drive 1020, (e.g., readinga CD-ROM disk 1022 or, to read from or write to other high capacityoptical media such as the DVD). The hard disk drive 1014, magnetic diskdrive 1016 and optical disk drive 1020 can be connected to the systembus 1008 by a hard disk drive interface 1024, a magnetic disk driveinterface 1026 and an optical drive interface 1028, respectively. Theinterface 1024 for external drive implementations includes at least oneor both of Universal Serial Bus (USB) and IEEE-1394 interfacetechnologies. Other external drive connection technologies are withincontemplation of the subject disclosure.

The drives and their associated computer-readable media providenonvolatile storage of data, data structures, computer-executableinstructions, and so forth. For the computer 1002, the drives and mediaaccommodate the storage of any data in a suitable digital format.Although the description of computer-readable media above refers to aHDD, a removable magnetic diskette, and a removable optical media suchas a CD or DVD, it should be appreciated by those skilled in the artthat other types of media which are readable by a computer, such as zipdrives, magnetic cassettes, flash memory cards, cartridges, and thelike, may also be used in the exemplary operating environment, andfurther, that any such media may contain computer-executableinstructions for performing the methods described herein.

A number of program modules can be stored in the drives and RAM 1012,including an operating system 1030, one or more application programs1032, other program modules 1034 and program data 1036. All or portionsof the operating system, applications, modules, and/or data can also becached in the RAM 1012. It is appreciated that the claimed subjectmatter can be implemented with various commercially available operatingsystems or combinations of operating systems.

A user can enter commands and information into the computer 1002 throughone or more wired/wireless input devices, e.g., a keyboard 1038 and apointing device, such as a mouse 1040. Other input devices (not shown)may include a microphone, an IR remote control, a joystick, a game pad,a stylus pen, touch screen, or the like. These and other input devicesare often connected to the processing unit 1004 through an input deviceinterface 1042 that is coupled to the system bus 1008, but can beconnected by other interfaces, such as a parallel port, a serial port,an IEEE-1394 port, a game port, a USB port, an IR interface, etc.

A monitor 1044 or other type of display device is also connected to thesystem bus 1008 via an interface, such as a video adapter 1046. Inaddition to the monitor 1044, a computer typically includes otherperipheral output devices (not shown), such as speakers, printers, etc.

The computer 1002 may operate in a networked environment using logicalconnections via wired and/or wireless communications to one or moreremote computers, such as a remote computer(s) 1048. The remotecomputer(s) 1048 can be a workstation, a server computer, a router, apersonal computer, portable computer, microprocessor-based entertainmentappliance, a peer device or other common network node, and typicallyincludes many or all of the elements described relative to the computer1002, although, for purposes of brevity, only a memory/storage device1050 is illustrated. The logical connections depicted includewired/wireless connectivity to a local area network (LAN) 1052 and/orlarger networks, e.g., a wide area network (WAN) 1054. Such LAN and WANnetworking environments are commonplace in offices and companies, andfacilitate enterprise-wide computer networks, such as intranets, all ofwhich may connect to a global communications network, e.g., theInternet.

When used in a LAN networking environment, the computer 1002 isconnected to the local network 1052 through a wired and/or wirelesscommunication network interface or adapter 1056. The adapter 1056 mayfacilitate wired or wireless communication to the LAN 1052, which mayalso include a wireless access point disposed thereon for communicatingwith the wireless adapter 1056.

When used in a WAN networking environment, the computer 1002 can includea modem 1058, or is connected to a communications server on the WAN1054, or has other means for establishing communications over the WAN1054, such as by way of the Internet. The modem 1058, which can beinternal or external and a wired or wireless device, is connected to thesystem bus 1008 via the serial port interface 1042. In a networkedenvironment, program modules depicted relative to the computer 1002, orportions thereof, can be stored in the remote memory/storage device1050. It will be appreciated that the network connections shown areexemplary and other means of establishing a communications link betweenthe computers can be used.

The computer 1002 is operable to communicate with any wireless devicesor entities operatively disposed in wireless communication, e.g., aprinter, scanner, desktop and/or portable computer, portable dataassistant, communications satellite, any piece of equipment or locationassociated with a wirelessly detectable tag (e.g., a kiosk, news stand,restroom), and telephone. This includes at least Wi-Fi and Bluetooth™wireless technologies. Thus, the communication can be a predefinedstructure as with a conventional network or simply an ad hoccommunication between at least two devices.

Wi-Fi, or Wireless Fidelity, is a wireless technology similar to thatused in a cell phone that enables a device to send and receive dataanywhere within the range of a base station. Wi-Fi networks useIEEE-802.11 (a, b, g, etc.) radio technologies to provide secure,reliable, and fast wireless connectivity. A Wi-Fi network can be used toconnect computers to each other, to the Internet, and to wired networks(which use IEEE-802.3 or Ethernet). Wi-Fi networks operate in theunlicensed 2.4 and 5 GHz radio bands, at an 13 Mbps (802.11a) or 54 Mbps(802.11b) data rate, for example, or with products that contain bothbands (dual band). Thus, networks using Wi-Fi wireless technology canprovide real-world performance similar to a 10 BaseT wired Ethernetnetwork.

As utilized herein, terms “component,” “system,” “creator,” “module,”“node,” “framework,” “application,” “translator,” and the like, areintended to refer to a computer-related entity or solid-stateelectronic, either hardware, software (e.g., in execution), and/orfirmware. For example, a component can be a process running on aprocessor, a processor, an object, an executable, a program, and/or acomputer. By way of illustration, both an application running on aserver and the server can be a component. One or more components canreside within a process and a component can be localized on one computerand/or distributed between two or more computers. In addition, acomponent can be hardware or solid state electronic such as anelectronic circuit, a semiconductor device, etc.

Moreover, the word “exemplary” is used herein to mean serving as anexample, instance, or illustration. Any aspect or design describedherein as “exemplary” is not necessarily to be construed as preferred oradvantageous over other aspects or designs. Rather, use of the wordexemplary is intended to present concepts in a concrete fashion. As usedin this application, the term “or” is intended to mean an inclusive “or”rather than an exclusive “or”. That is, unless specified otherwise, orclear from context, “X employs A or B” is intended to mean any of thenatural inclusive permutations. That is, if X employs A; X employs B; orX employs both A and B, then “X employs A or B” is satisfied under anyof the foregoing instances. In addition, the articles “a” and “an” asused in this application and the appended claims should generally beconstrued to mean “one or more” unless specified otherwise or clear fromcontext to be directed to a singular form.

What has been described above includes examples of aspects of thedisclosed subject matter. It is, of course, not possible to describeevery conceivable combination of components or methodologies forpurposes of describing the disclosed subject matter, but one of ordinaryskill in the art may recognize that many further combinations andpermutations of the disclosed subject matter are possible. Accordingly,the disclosed subject matter is intended to embrace all suchalterations, modifications and variations that fall within the spiritand scope of the appended claims. Furthermore, to the extent that theterms “includes,” “has,” or “having,” or variations thereof, are used ineither the detailed description or the claims, such terms are intendedto be inclusive in a manner similar to the term “comprising” as“comprising” is interpreted when employed as a transitional word in aclaim.

What is claimed is:
 1. A network appliance, comprising: a processor; amemory communicatively coupled to processor, the memory having storedtherein computer-executable instructions, comprising: a protocol buffercomponent configured to: receive a first series of bytes representing atoken request having credential information from a requestor;de-serialize the first series of bytes into a token request protocolmessage object retaining the credential information, wherein the tokenrequest protocol message object is formatted according to a ProtocolBuffer definition; convert the token request protocol message objectinto a second token request protocol message object having a firstformat associated with an external entity; and a security token serviceconfigured to: send the second token request protocol message object tothe external entity; receive a first protocol buffer security token,having a representation not formatted according to the Protocol Bufferdefinition, from the external entity; convert the first protocol buffersecurity token into a second protocol buffer security token structuredin accordance with the Protocol Buffer definition; serialize the secondprotocol buffer security token into a second series of bytes; andcommunicate the second series of bytes as a response to the tokenrequest.
 2. The network appliance of claim 1, wherein the ProtocolBuffer definition is programming language neutral, execution platformneutral, and extensible.
 3. The network appliance of claim 1, furthercomprising a cryptography component configured to verify a digitalsignature attached to the token request.
 4. The network appliance ofclaim 3, wherein the cryptography component is further configured todigitally sign the first protocol buffer security token.
 5. The networkappliance of claim 1, wherein the security token component furthercomprises an authentication component configured to validate thecredential information with a data store that stores accountinformation.
 6. The network appliance of claim 1, further comprising aprotocol buffer compiler configured to compile the Protocol Bufferdefinition into a serialization mechanism configured to serialize tokenrequest protocol message objects into series' of bytes.
 7. The networkappliance of claim 1, further comprising a protocol buffer compilerconfigured to compile the Protocol Buffer definition into ade-serialization mechanism configured to de-serialize series of bytesinto token request protocol message objects.
 8. The network appliance ofclaim 1, further comprising a protocol buffer compiler configured tocompile the Protocol Buffer definition into a data access mechanismconfigured to access data in token request protocol message objects. 9.A system, comprising: a processor; a memory communicatively coupled toprocessor, the memory having stored therein computer-executableinstructions, comprising: a gateway component configured to: receive afirst series of bytes representing a token request having credentialinformation from a requestor; de-serialize the first series of bytesinto a token request protocol message object retaining the credentialinformation, wherein the token request protocol message object isformatted according to a Protocol Buffer definition; convert the tokenrequest protocol message object into a second token request protocolmessage object having a first format associated with an external entity;send the second token request protocol message object to the externalentity; receive a first protocol buffer security token, having arepresentation not formatted according to the Protocol Bufferdefinition, from the external entity; convert the first protocol buffersecurity token into a second protocol buffer security token structuredin accordance with the Protocol Buffer definition; serialize the secondprotocol buffer security token into a second series of bytes; andcommunicate the second series of bytes as a response to the tokenrequest.
 10. The system of claim 9, wherein the gateway component isfurther configured to verify a digital signature attached to the tokenrequest.
 11. The system of claim 10, wherein the gateway component isfurther configured to digitally sign the first protocol buffer securitytoken.
 12. The system of claim 9, wherein the gateway component isfurther configured to compile the Protocol Buffer definition into aserialization mechanism configured to serialize token request protocolmessage objects into series' of bytes.
 13. The system of claim 9,wherein the gateway component is further configured to compile theProtocol Buffer definition into a de-serialization mechanism configuredto de-serialize series of bytes into token request protocol messageobjects.
 14. The system of claim 9, wherein the gateway component isfurther configured to compile the Protocol Buffer definition into a dataaccess mechanism configured to access data in token request protocolmessage objects.
 15. A method, comprising: obtaining, by a securityapparatus including a processor, a token request, as a series of bytes,that includes credential information to be authenticated;de-serializing, by the security apparatus, the series of bytes to obtainthe token request as an object structured in accordance with a ProtocolBuffer definition; converting, by the security apparatus, the tokenrequest, structured in accordance with the Protocol Buffer definition,into a second token request having a format associated with an externalentity; sending, by the security apparatus, the second token request tothe external entity; receiving, by the security apparatus, a firstsecurity token, having a representation not formatted according to theProtocol Buffer definition, from the external entity; converting, by thesecurity apparatus, the first security token into a second securitytoken structured in accordance with the Protocol Buffer definition;serializing, by the security apparatus, the second security token into abyte stream; and communicating, by the security apparatus, the bytestream as a response to the token request.
 16. The method of claim 15,further comprising verifying, by the security apparatus, a digitalsignature attached to the token request.
 17. The method of claim 16,further comprising, by the security apparatus, digitally signing thefirst protocol buffer security token.
 18. The method of claim 15,further comprising compiling, by the security apparatus, the ProtocolBuffer definition into a serialization mechanism configured to serializeobjects structured in accordance with the Protocol Buffer definitioninto series' of bytes.
 19. The method of claim 15, further comprisingcompiling, by the security apparatus, the Protocol Buffer definitioninto a de-serialization mechanism configured to de-serialize bytestreams into objects structured in accordance with the Protocol Bufferdefinition.
 20. The method of claim 15, further comprising compiling, bythe security apparatus, the Protocol Buffer definition into a dataaccess mechanism configured to access data in objects structured inaccordance with the Protocol Buffer definition.